diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1fa222a
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.vaulto
diff --git a/ansible.cfg b/ansible.cfg
index 1253935..a6b0608 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -5,3 +5,5 @@ stdout_callback = yaml
 bin_ansible_callbacks = True
 
 host_key_checking = false
+
+vault_password_file: /etc/ansible/.vaulto
diff --git a/environments/base/group_vars/all/ssh-creds.yml b/environments/base/group_vars/all/ssh-creds.yml
index aaf2a7a..bcdb961 100644
--- a/environments/base/group_vars/all/ssh-creds.yml
+++ b/environments/base/group_vars/all/ssh-creds.yml
@@ -1,4 +1,10 @@
----
-ansible_ssh_user: hogweed1
-ansible_ssh_pass: coloredhorses
-ansible_sudo_pass: coloredhorses
+$ANSIBLE_VAULT;1.1;AES256
+31363137313338616231343430646133386434313864323835633839353631313262313365396662
+6430623831346630336138613735653333386565346461300a326639383234383063646366343039
+32396436373561376431383338643464313131336135333864336530636164616661616261363930
+3662306533383232660a386464396437653835356564333032393063386532346463376332626536
+35373439633936396539383163396632313462626336363164353038643664633734326136356135
+36656235616231363234323632393833323035313739363565393932326535643834633464303361
+63643531643430336164336261653539353236346533653030336634383031663535383264383365
+32653235386436303133623233653235356131643633643937373630333166373063633731353661
+36393539333435366439313364633735326339646264626262633063633664626461